feat: require a zero-error product typecheck and a test type-debt ratchet

Adds tsconfig.json (strict) over product code, fixes its remaining 90
diagnostics (type-only, interface corrections, and explicit narrowing),
and adds a typecheck job to the required free-tests aggregate running
bun run typecheck, the test-code ratchet (identity -> count baseline, fails
on new, repeated, or unlocked fixed diagnostics), and the lib/cso format
check. Reuses fixes from #2447 where they still applied.

.github/workflows/free-tests.yml

@@ -137,6 +137,25 @@ jobs:
           GSTACK_CSO_DOCKER_TESTS: "1"
           DOCKER_HOST: unix:///var/run/docker.sock
 
+  typecheck:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.0
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+      - name: Typecheck product code (zero errors)
+        run: bun run typecheck
+      - name: Test-code type-debt ratchet
+        run: bun run typecheck:test
+      - name: CSO source formatting
+        run: bun run format:cso:check
+
   free-suite:
     needs: free-plan
     runs-on: ubicloud-standard-8
@@ -304,19 +323,21 @@ jobs:
   # gate is merge-blocking without a separate branch-protection migration.
   free-tests:
     if: always()
-    needs: [free-suite, cso-macos-launcher, cso-windows-launcher, cso-docker-integration]
+    needs: [free-suite, typecheck, cso-macos-launcher, cso-windows-launcher, cso-docker-integration]
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - name: Require the free suite and every CSO platform gate
+      - name: Require the free suite, typecheck, and every CSO platform gate
         env:
           FREE_SUITE_RESULT: ${{ needs.free-suite.result }}
+          TYPECHECK_RESULT: ${{ needs.typecheck.result }}
           CSO_MACOS_RESULT: ${{ needs.cso-macos-launcher.result }}
           CSO_WINDOWS_RESULT: ${{ needs.cso-windows-launcher.result }}
           CSO_DOCKER_RESULT: ${{ needs.cso-docker-integration.result }}
         run: |
           set -eu
           test "$FREE_SUITE_RESULT" = success
+          test "$TYPECHECK_RESULT" = success
           test "$CSO_MACOS_RESULT" = success
           test "$CSO_WINDOWS_RESULT" = success
           test "$CSO_DOCKER_RESULT" = success